Adaptive trust negotiation and access control

ABSTRACT

Electronic transactions regularly occur between business partners in separate security domains. Trust negotiation is an approach that provides an open authentication and access-control environment for such transactions, but it is vulnerable to malicious attacks leading to denial of service or leakage of sensitive information. This paper introduces an Adaptive Trust Negotiation and Access Control (ATNAC) framework to solve these problems. The framework combines two existing systems, TrustBuilder and GAA-API, to create a system with more flexibility and responsiveness to attack than either system currently provides.

References

1. Becker, M. Y. and Sewell, P. Cassandra: distributed access control policies with tunable expressiveness. In Policies in Distributed Systems and Networks, June 2004.
2. Bertino, B., Ferrari, E., and Squicciarini, A.C. Trust-X: A Peer-to-Peer Framework for Trust Establishment. In IEEE Transactions on Knowledge and Data Engineering, 16, 7 (July 2004).
3. Bonatti, P. and Samarati, P. A Unified Framework for Regulating Access and Information Release on the Web. In Journal of Computer Security, 10, 3, (2002), 241--271.
4. Herzberg, A., Mass, Y., Mihaeli, J., Naor, D., and Ravid, Y. Access control meets public key infrastructure, or: Assigning roles to strangers. In Proceedings of the 2000 IEEE Symposium on Security and Privacy, May 2000, 2--14.
5. Jim, T. SD3: A Trust Management System With Certified Evaluation. In IEEE Symposium on Security and Privacy, Oakland, CA, May 2001.
6. Li, N., Mitchell, J., and Winsborough, W. RT: A role-based trust-management framework. In Proceedings of The Third DARPA Information Survivability Conference and Exposition (DISCEX III), April 2003.
7. Nejdl, W., Olmedilla, D., and Winslett, M. PeerTrust: Automated Trust Negotiation for Peers on the Semantic Web. In Proceedings of the Workshop on Secure Data Management in a Connected World (SDM '04) in conjunction with 30th International Conference on Very Large Databases, Aug./Sept. 2004.
8. Ryutov, T. and Neuman, C. The Specification and Enforcement of Advanced Security Policies. In Third International Workshop on Policies for Distributed Systems and Networks (POLICY 2002), Monterey, CA, June 2002.
9. Ryutov, T., Neuman, C., and Kim, D. Dynamic Authorization and Intrusion Response in Distributed Systems. In Proceedings fo the 3rd DARPA Information Survivability Conference and Exposition (DISCEX III), Washington, D.C., Apr. 2003.
10. Ryutov, T., Neuman, C., Kim, D., and Zhou, L. Integrated Access Control and Intrusion Detection for Web Servers. In IEEE Transactions on Parallel and Distributed Systems, 14, 9 (Sept. 2003), 841-850.
11. Skogsrud, H., Benatallah, B., and Casati, F. Model-driven trust negotiation for Web services. IEEE Internet Computing, 7, 6 (Nov./Dec. 2003).
12. Winsborough, W. and Li, N. Towards Practical Automated Trust Negotiation. In Third International Workshop on Policies for Distributed Systems and Networks (POLICY 2002), Monterey, CA, June 2002.
13. Winsborough, W.H., Seamons, K.E., and Jones, V.E. Automated trust negotiation. In DARPA Information Survivability Conference and Exposition, Volume 1, Hilton Head, SC, 2000, 88-102.
14. Winslett, M., Yu, T., Seamons, K. E., Hess, A., Jacobson, J., Jarvis, R., Smith, B., and Yu, L. Negotiating Trust on the Web. IEEE Internet Computing, 6, 6 (Nov./Dec. 2002).

Index Terms

• Security and privacy

  • Security services

    • Access control

    • Authentication

  • Systems security

    • Operating systems security